Writing
76 posts since 2020. Notes on blue teaming, detection engineering, SIEM/SOAR and incident response.
Featured
- 01MCP and SIEM Integration: Permission Surface Analysis on Splunk (Part 1)In this article we look at the MCP (Model Context Protocol) and Splunk integration from a security point of view. It covers the setup steps, the permission surface of the tools the server exposes and the precautions worth taking.
- 02Developing Sigma Rules1. What Is a Sigma Rule? A Sigma rule is an open-source language and rule-set format used to detect and investigate security events and threats.…
- 03What Is This Log4j RCE (Log4Shell)?In my new article, I'll be talking about a vulnerability that has been heavily discussed over the past few days. I hope it's useful. :) The vulnerability…
20261
20242
Malware Distribution Techniques Using LNK Files
In this article, we'll go step by step through how malware can be distributed using LNK files. In particular, we'll look at how malicious commands can be embedded…
My Threat Report Resources - CTI
Cyber Threat Intelligence (CTI) provides security professionals with vital information about cyber attacks and…
20236
Developing Sigma Rules
1. What Is a Sigma Rule? A Sigma rule is an open-source language and rule-set format used to detect and investigate security events and threats.…
Detecting Ransomware Threats: StopRansomware - LockBit 3.0 Exploits CVE-2023-4966 in Citrix Bleed Vulnerability
The recently discovered Citrix Bleed vulnerability (CVE-2023-4966) poses a serious threat to computer security. Stemming from a…
Methods of Threat Actors Adapting to the Post-Macro Era
Microsoft announced in October 2021 that it would start blocking XL4 and VBA macros by default for Office users, rolling this out in February 2022…
Microsoft Outlook Forensic Analysis
Techniques and Tools for Detecting Malicious Activities Microsoft Outlook is a popular email client used by millions of people worldwide. However, it has also become a…
CVE-2022-23935 Exploit
Exploit for CVE-2022-23935, a command injection in ExifTool before 12.38 caused by improper file name handling.
CVE-2023-22809 - sudo 1.8.0 - 1.9.12p1 - Privilege Escalation
Exploit for CVE-2023-22809, a privilege escalation in sudo 1.8.0 – 1.9.12p1 via sudoedit.
202210
WMIC-WMI for Incident Response and Threat Hunting
In this article, I will talk about what WMI and WMIC are, which play an important role in Incident Response, Threat Hunting, and detecting attacks, along with…
Hunting for Persistence: Registry Run Keys / Startup Folder
In this article, I will try to explain a technique used by attackers to establish persistence on target systems, corresponding to ATT&CK ID T1547.001 in the MITRE ATT&CK…
Behavior Analysis: Task Scheduler
Hello everyone, in this article I will give you information about the Task Scheduler, which was created to ensure persistence on Windows Systems. Let's start. :)…
DeepBlueCLI: Threat Hunting with the PowerShell Module
In this article I'll demonstrate threat hunting using the DeepBlueCLI module developed by Eric Conrad. DeepBlueCLI is a PowerShell module for Windows…
Cyber Threat Hunting and Hunt the IOC
Today, in environments where widely used cybersecurity solutions are deployed, there are alarm evaluation systems built for security purposes. There are centralized log…
How to Leverage MITRE ATT&CK for Threat Intelligence
In this article I'll cover how to leverage the MITRE ATT&CK matrix for Cyber Threat Intelligence. In recent years, security professionals have been looking…
PowerShell Artifact Analizi
In this article, I will cover one of the most important areas that needs to be analyzed during Incident Response processes. Detecting commands written…
Windows Commands Every Incident Responder Should Know
In this article I'll cover the commands you need to know when investigating Windows systems. The commands I'll cover here are the fundamental commands an…
IOC Detection in Incident Response Processes with "LOKI"
In this article, I will talk about LOKI, an Open Source IOC scanning tool, and what it's used for. I hope it's useful, happy reading in advance. Threat intelligence…
Linux Commands to Know During the Incident Response Process
In this article, I'll cover the following commands you need to know during incident response processes on Linux systems: user account commands, log entry…
202138
WAZUH - Host-Based Intrusion Detection System (HIDS)
In my new article I've covered Wazuh, a host-based intrusion detection system. I hope you find it useful. :) What Is Wazuh? Wazuh is an open-source Host Detection…
Mail Header Analizi
In this article, I tried to talk to you about email header fields and their importance from a digital forensics perspective. I tried to explain step by…
What Is This Log4j RCE (Log4Shell)?
In my new article, I'll be talking about a vulnerability that has been heavily discussed over the past few days. I hope it's useful. :) The vulnerability…
Log Analysis with PowerShell
In my new article, I'll share information about where the commands run using PowerShell are kept and how they can be viewed. I'll then go on to talk about…
T-POT Honeypot Setup, Configuration, and Viewing via Kibana
In this article, I'll talk about how to set up a T-POT honeypot on virtualization and how to review the logs there. What is a Honeypot?…
Viewing Brute Force and Nmap Logs Through Security Onion / Kibana
In this article, I'll be doing log monitoring using Security Onion, which I set up on a virtual machine, and the Kibana instance that comes with it. Here, I'll go…
Hydra Nedir, TryHackMe Hydra Walkthrough
The Hydra tool comes pre-installed on Kali Linux and is used to carry out Brute-Force attacks. Using Hydra together with a previously prepared wordlist…
The Cyber Attack Lifecycle, Cyber Kill Chain
Cyber Kill Chain " Kill Chain " emerged as a military term, meaning Chain of Death in Turkish. And its purpose was to be used by militaries to define the…
How to Parse $MFT?
In this article, I'll cover "how to parse MFT?" There are many tools available for parsing MFT records. In this article, I used three tools to carry out the MFT…
What Is the Master File Table? Understanding the MFT
In digital forensics, disk analysis is performed to detect a crime or an incident. In the file systems section I covered in my earlier articles, we learned…
Windows File Systems
In this article, I'll cover, in order: What a file is, the structure and working logic of a hard disk, File System, the Duties of a File System, the file structure in Windows Systems, FAT 16,…
Examining EXIF Data from a Digital Forensics Perspective
EXIF was designed and released in 1998 by the “Japan Electronic Industries Development Association” (JEIDA). Since its release, it has grown so important that it can…
Recovering Deleted Files with FTK Imager
In this article, I will talk about how to easily recover files that were accidentally or unknowingly deleted from a Flash Drive, using…
Windows Log Analysis: Important Concepts
In this article, I'll try to give you information about the event logs, Event IDs, and why and how important these ID numbers are for us during Windows…
Types of Web Servers and Examining Their LOG Records
Today, the most commonly used web server types are generally Apache, IIS, and Nginx. APACHE Web Server and Log Records Being open source, flexible, robust…
PCI/DSS
PCI/DSS, the Payment Card Industry Data Security Standard, is a set of security standards designed to ensure that all companies that accept, process, store or…
How to Compile and Install Linux Kernel 5.12.12 from Source Code?
In this article, I'll walk you through how to compile the latest version of the Linux kernel, for anyone having trouble compiling it themselves. I'll…
Viewing Active Directory Logs in Event Viewer
Active Directory(AD) plays a critical role in account management, covering both computer and user accounts. In particular, Active Directory…
Log Files on Linux Systems
In this article I'll cover the following topics in order: Log Records Why Are Log Records Kept? Linux System Logs Linux System Log Files 1) Log Records…
Assigning Restrictions to Users with Group Policy
In my previous article, we created a Group Policy. However, we hadn't defined any restrictions on it. In this section, we'll define a restriction inside the Group Policy…
Creating and Examining Group Policy
When we hear Group Policy, the first thing that should come to mind is restrictions. This console is where restrictions are assigned to the computers and…
Setting User Logon Hours on Active Directory
In a company, logon hours are configured to prevent employees from working outside of business hours and accessing domain resources. These hours are set…
Restricting Which Computers Users Can Log On To in Active Directory
Normally, a user under a domain can log on to any computer in that domain. In this article, I'll show you how to restrict certain Active Directory users to…
Joining a Windows 10 Machine to a Domain and IP Configuration
In this article, I'll show you how a Windows 10 machine I set up in a virtualized environment can be joined to a domain. Here, the computer I create and join to the…
Creating Groups in Active Directory and Group Membership Concepts
In this article, I will talk about how to create a group or groups in Active Directory and cover group membership concepts. I will also…
Organizational Unit Configuration in Active Directory
As you can probably tell from the title, in this article I'll do my best to walk you through " Organizational Unit Configuration in Active Directory ".…
Creating a User Account in an Active Directory Environment
In this article I'll walk you through how to create a user account (or accounts) in Active Directory. Happy reading.
Domain, Domain Controller, Active Directory, Group Policy Concepts and Their Relationships
With this article, I'm starting a new series titled " Windows Server and System Administration ", based on what I've recently researched and a training I took.…
Installing and Configuring Active Directory and Domain Controller on Windows Server 2016
In this article, I'll try to walk you step by step through installing and configuring Active Directory and Domain Controller on Windows Server 2016. To better…
Installing and Configuring "Nginx" on Ubuntu 18.04
In this article, I'll go step by step through the following: Installing Nginx, Configuring the Firewall, Checking the Web Server, Managing the Nginx Service, Setting…
Hiding and Analyzing Text Inside Audio Files Using the "Steganography" Method
As you can tell from the title, in this article we'll create an audio file. Inside this audio file, we'll hide a piece of text we've chosen using the "steganography" method.…
Erasmus Diaries
SKOPJE, CITY OF STATUES
Wordpress Pentest için WPScan
In this article, I will talk about the usage and commands of the WPScan tool, which comes pre-installed on Kali Linux. WPScan WPScan is an open-source…
Malicious Traffic Analysis - Examining a "pcap" File with Wireshark
Malicious Traffic Analysis is a form of analysis that aims to detect abnormal network behavior that differs from what activity should look like, by examining…
Web Siteleri Üzerinde SSL/TLS Check
What Is SSL? SSL is short for Secure Sockets Layer and provides security at the socket level. SSL certificates are a concept most of us are familiar…
What is YARA? Preparing a YARA Rule for the Zeus Botnet
In this article, I'll try to explain what a YARA rule is and how a YARA rule is written, using the Zeus Botnet malware as an example. Happy reading. :) What is YARA?…
Exporting the Windows 10 Event Viewer
. In this article I'll try to give some information about a concept every Windows 10 user should know, the Event Viewer. And then I'll cover how we can…
ELK Stack Kurulumu-(Windows)
Although it's generally safer to deploy the ELK Stack (Elastic stack) on Linux distributions, I'll be installing ELK on Windows today and going over a…
202019
ARP(Adress Resolution Protocol)
I hope this article is useful for you. Happy reading. :) ARP (Adress Resolution Protocol) is used to determine the MAC addresses of devices on a local network…
Web Uygulama Güvenliği
In this article, I will try to give you information on the topic of "Web Application Security". I want to note that I am not very experienced or…
How DNS Works: Gathering Network Information Through DNS Queries
In this post I'll try to explain "what DNS (Domain Name System) is, how it works, and how to gather information about a network through DNS queries?"
Search Engines and Google Hacking - The "Dork" Concept
In this post we'll look at how to search using Google's advanced search operators, a technique known as Google Hacking. Also known as "Dorking"…
What Is Nmap? Querying Port and Version Information with Nmap
In this post, I'll cover what Nmap is, its use cases, and how to use it, without getting too into the weeds. What is Nmap? Nmap…
Looking Up Contact Information with the Whois Tool
In this article, I'll talk about the usage of the Whois tool, one of the passive information gathering tools in cybersecurity that comes pre-installed. Happy reading.…
Installing Ubuntu on a Virtual Machine with VirtualBox (with images)
In this article, as you can tell from the title, I'll walk you through how to install the Ubuntu operating system on our virtual machine, with images. In my previous articles…
What Is Kali Linux, How Is It Installed on a Virtual Machine
In today's article, I'll show you how to install Kali Linux, a Linux operating system distribution mostly used for hacking purposes, on our virtual machine.…
FTK IMAGER NEDİR, KURULUMU VE İMAJ ALMA
In this article, I will walk you, my valued readers, through the installation of FTK IMAGER, an important imaging tool used in Digital Forensics, and the…
Programming Languages You Should Know for Hacking
First, let me give you some very brief background on "Programming Languages." Programming languages are the general pieces of code programmers use to express a given algorithm…
Penetration Testing
In this article, I will try to give you information about Penetration testing. I hope it's a useful article for you. Thank you all in advance. Happy…
The Investigation Process of a Forensic Incident and the Rules to Follow
Hello everyone, today I will talk about the processes involved in a forensic incident and the rules we need to follow when managing these processes. Without…
The Stages of How Hackers Attack Our Systems
Dear readers, hello :) In this article, I will try to give you information under the title " The Stages of How Hackers Attack Our Systems ?" I hope it's…
Operating Systems: What Are the Different Types of Operating Systems?
Dear readers, hello to all of you. In my previous posts I covered virtualization and installing VirtualBox. In this post, I'll talk about the main theme behind those two…
What Is VirtualBox? How Is It Installed? (With Screenshots)
Virtualbox is a free and open-source virtualization program. It can run on all cross-platform-supported operating systems such as Windows, Linux, and OS…
The Most Common Types of Malware Today
Dear readers, hello to all of you. In my last post I talked about hackers. In this post, I want to talk about the malware types most commonly encountered today and…
What Is a Hacker? Who Are Hackers? What Are Their Types?
The people who, by the first definition that comes to mind, capture the interest of most of us and spark excitement are ' HACKERS '. With the development of today's technology, what many people call a…
What Is Virtualization, What Is a Virtual Machine, and What Is It For?
In this article I'll try to give you some information on the topics of: What is virtualization? Is virtualization secure? What is a virtual machine? Now…
What Is Digital Forensics Engineering? What Does It Do?
Digital Forensics Engineering is a department established in 2013 within Fırat University's Faculty of Technology. Even though it's a newly established department, many people…
Nothing matches.